Zeus is the bad actor in this scenario. Room for changes but I blocked paying zeuspay for this same issue weeks ago. I agree that others could do this, and it exposes a weakness in HTLCs effectively taken hostage in transit.